1.
Is this okay!?
Rouan Wilsenach
Engineering Lead, Haven
@rouanw
Reviewing code for security issues

2.
Too much
pressure
Code reviews are great for
catching issues but they can’t be
the only thing.
- Build awareness 💬
- Threat modelling 🐉
- Pen testing 🔦

3.
Where’s the input
going?
- Is there new input?
- Have we changed the way
input is handled?
- Where it’s stored?
- How it’s used later?
1 .

4.
Are the right AAA
checks in place?
- Authentication - have we
checked the actor is who
they say they are?
- Authorisation - have we
checked they’re allowed to
do this?
- Auditing - have we made a
note of what happened?
2 .

5.
Have the assets
changed?
Are we storing any personal or
special information? E.g.
- Emails
- Health info
- Credit cards
- Racial or ethnic origin
- Political or religious info
3 .

6.
Are you leaking
data?
- Is your API returning extra
bits?
- Are you logging stuff you
shouldn’t?
- Don’t keep anything you
don’t need
4 .

7.
Any new
dependencies?
Do some research on new
dependencies. Are they:
- Trusted
- Popular
- Well maintained
- Do you really need it?
5 .

8.
Has the config
changed?
- Misconfiguration is a super
common cause of security
issues
- If your config isn’t code,
you can’t review it!
6 .

9.
Is anything being
cached?
- Don’t show one user’s
sensitive info to another!
- Everyone should
understand the default
cache behaviour
- Good cache keys
7 .

10.
Have you checked
the borders?
Handy trick if you’re short on
time is to focus on where data
enters and leaves your system -
e.g. where a web request comes
in and where we talk to a
database.
8 .

11.
A few tricks that helped me learn
Find your
security
mentor
Turn up at
post
mortems
Smashing
Security
Podcast
Offer help
during pen
tests
Find a
security
course
online

12.
1 .
2 .
3 .
4 .
5 .
6 .
7 .
8 .
Inputs
AAA
Asset type
Data leaks
Dependencies
Boundaries
Config
Caching
Reviewing code for security issues – Cheat Sheet
@rouanw

13.
Is this okay!?
Rouan Wilsenach
Engineering Lead, Haven
@rouanw
Reviewing code for security issues